Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Forgiva – Never saves your passwords but regenerates them

forgiva.com

Post reply on HN
Print view View original

41–50 of 98 posts

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#41

Post by SNvD7vEJ »

ComodoHacker wrote: post #35
marcusfrex wrote: post #4

Earlier quoted context omitted.

>> How does this compare, for example, to the KeePass family of pw-managers? It is a password manager too but with an alternative approach. >> "Fixes poor passwords, accessibility and storage problems with highly secure way." >> What does that even mean? Generates strong passwords by default, you can access them anywhere with it and does not need to store anywhere.

>you can access them anywhere with it and does not need to store anywhere But you have to carry the database with you anyway and have to store somewhere. So what's the point of having database with everything but passwords? And you still need the database encrypted, because you don't want to give the attacker your usernames, emails, recovery answers and other stuff, do you?

Maybe the point is that you do not need to store the database securely, that you can store it openly, as long as the certificate used to generate the passwords is kept secret.

But you probably want to keep the meta info of what sites you have access to secret to.

So I don't know why this is better than simply use the certificate to encrypt the database.

But maybe I did not understand how it works.

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#42

Post by SpendBig »

SNvD7vEJ wrote: post #39
SpendBig wrote: post #14

Your password will never be secure when you store it on someone else his disk or let someone else encrypt your password. Its not a matter of how, but when there will be a way to retreive those passwords by anything but you. And its not just that, everything you use your passwords for these days, is stored on some sort of storage in a cloudy architecture. Scattered all over the world in thousands of datacenters. You p…

What do you mean? This solution does not store passwords at all, if I understand it correctly. So whining about storing them on "someone else disk" is a bit odd, don't you think?

In the overview, it says on cloud or local. Which made me think, why would you even suggest storing this on a cloudy device when your offering a password manager.

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#43

Post by icebraining »

SpendBig wrote: post #42
SNvD7vEJ wrote: post #39

Earlier quoted context omitted.

What do you mean? This solution does not store passwords at all, if I understand it correctly. So whining about storing them on "someone else disk" is a bit odd, don't you think?

In the overview, it says on cloud or local. Which made me think, why would you even suggest storing this on a cloudy device when your offering a password manager.

In the overview, it says on cloud or local.

Where? I don't see "cloud" anywhere on that page..?

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#44

Post by Klathmon »

SpendBig wrote: post #42
SNvD7vEJ wrote: post #39

Earlier quoted context omitted.

What do you mean? This solution does not store passwords at all, if I understand it correctly. So whining about storing them on "someone else disk" is a bit odd, don't you think?

In the overview, it says on cloud or local. Which made me think, why would you even suggest storing this on a cloudy device when your offering a password manager.

Why would offering cloud storage as an option be a problem if you don't use it?

Some people value usability over absolute security.

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#46

Post by zerognowl »

nautical wrote: post #36

This is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free . http://masterpasswordapp.com/

+1 for masterpassword. I always loved the concept of brain vaults. One thing about masterpassword is that I don't trust the clients and I can't inspect what's being logged when I fire up the app. The iOS app is closed source and proprietary and although the idea is great, the clients are not to be trusted. Get yourself a copy of the Javascript client, and place it in a secure VM so you have full oversight of what the code is doing. And don't let the application talk to the internet...

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#48

Post by type0 »

mynameislegion wrote: post #34
dom96 wrote: post #17

Earlier quoted context omitted.

It looks like it isn't completely closed source, https://github.com/sceptive/Forgiva .

NC licenses aren't considered "Open Source": http://www.opensource.org/docs/osd

Then this company - Sceptive is kinda Deceptive. It says on their web page: "Or clone Open Source implementation from Github"

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#49

Post by SloopJon »

As I see it, the main benefit of deterministic password generation is the convenience of not needing a password database. Indeed, if the scheme is simple and/or portable enough (e.g., PBKDF2) you can implement it from scratch in a minute or two, depending on what software you have handy. The convenience breaks down as you need to maintain additional state: password rotation, site-specific password rules, etc.

Forgiva is based on the premise that a password generation scheme is more secure than a password database. I'm unconvinced in general; from what I see in the FAQ and the Ruby code on Github, even less so for this particular implementation. Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell.

Post reply on HN